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Security authorisation system fand Method! 




This invention relates to security systems and. particularly to confining correct operation of 
functional apparatus to the presence of an authorised user [and more particularly to disabling 
functioning apparatus separated from the authorised user] . 

The invention is concerned with apparatus which functions under the direct control of an 
operator as, or on behalf of, an authorised user [in possession of the apparatus or apparatus- 
controlling devices that equate to possession of the apparatus* For convenience, at least in] 
and in this respect, as least for convenience in discussion of the bacl<ground to the invention, 
a suitably authorised operator and an authorised user are considered synonymous, although 
they need not be. 

The invention is concerned particularly, but not exclusively, with functional apparatus which 
is moveable Insofar as the apparatus or a constituent thereof can be removed to a place 
unknown to the authorised user. It concerns apparatus which is physically in the possession 
of the authorised user, carried thereby (such as a cellular telephone or a computing device) 
or vice versa (such as a motor vehicle), and apparatus function-controlling devices, 
conveniently herein called "key devices", which themselves may constitute functional 
apparatus with a limited degree of functionality required to initiate operation of apparatus, and 
which apparatus or devices may nevertheless be snatched from the authorised user as a 
criminal act preclicated upon the element of surprise and/or menace, where the speed by which 
the authorised user, or victim, is deprived thereof renders the criminal less likely to be 
Jdentifiable and/or the victim less.iikely to resist and increase the seriousness of the crime with 
personal violence. . 
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The Invention is particularly concerned with moveable apparatus in the form of a motor vehicle 
in which a driver forms the operator, and which because of Its value and/or utility to a criminal 
is an attractive target.. Although many vehicles have sophisticated entry- and function- 
authorising systems which deny entry to, and/or Initiating functioning of, the vehicle to any 
potential operator without the correct key devices, and patent specification number GB-A- 
2342742 exemplifies the level of the measures proposed to prevent circumventing use of the 
correct key devices, the situation still exists whereby the person In possession of these key 
devices is de facto the authorised user. 

Because of such sophistication, it has become commonplace for vehicle thieves to avoid 
attempting to by-pass entry-denial' and ignition-denial systems, instead stealing genuine key 
devices from the premises of the genuine holder using standard burglary or sneak-thlef 
techniques that avoid contact with the holder, or by robbery, snatching the key devices from 
the person of the genuine holder within such premises or as the holder transits between the 
premises and the vehicle. 

[It Is also known to replace or supplement such physically held key devices by some form of 
personal code which the authorised operative enters Into vehicles by a key pad or the like 
which ostensibly mitigates any benefit to a criminal simply taking possession of the key 
devices, but it is believed by some that such a feature may in practise put both the possessor 
of the code and robber in increased personal danger by confrontation to effect forced 
divulgence.] 

However, having regard to [the above mentioned personal authorisation code being required 
to enter the vehicle and/or start the vehicle engine and] the fact that many operators now 
transit between vehicles and premises In places not readily accessible to criminals, unattended 



P650391GB -3- 3 May 2002 (4:00PM) 

theft is becoming more unattractive and it is becoming more prevalent for criminals to snatch 
a fully-functioning vehicle when It Is-brought to a halt by a traffic sign, signal or obstruction and 
forcing a surprised and disorientated driver to leave the functioning vehicle which is ready to 
be driven away. Such crime is frequently referred to as "hijacking" or "carjacking", and the 
terms are used herein in this context. 

Proposals have been made to address the problem of unauthorised driving way of a vehicle 
as a result of unattended theft or hijacking. WO 01/32479 describes a system including a 
cellular phone arrangement whereby in addition to notifying the authorised operator that an 
unattended alarm condition has been recognised, it also permits the authorised operative, if 
in possession of a phone, to disable the vehicle remotely; such a system would apparently 
permit the victim of a hijacking also to remotely disable the taken vehicle. In a similar manner, 
US 6,206,130 describes a hand-held security system transmitting device by which the 
authorised operator may actively enable or disable functioning of the vehicle remotely, 
although it must be operated whilst the vehicle is in the vicinity. However, in both of the above, 
a positive action is required in the part of the authorised operator and in the circumstances of 
a hijacking this may not occur to a disorientated victim until it is too late to take appropriate 
action. Furthermore, It is likely that a hijacker would force a victim to hand over a phone 
device or other apparent vehicle-specific device to delay reporting of the incident to the 
authorities, 

US 5^494,130 also addresses the problem of vehicle hijacking by having built into the vehicle 
a driver's seat switch to detect the driver leaving the seat of a functioning vehicle and 
therefrom initiating a delayed immobilisation of the vehicle such that an unsuspecting hijacker 
creates a separation in space and time from the victim/authorised operator before the vehicle 
is fully Immobilised. However, insofar as such system may be known by a potential hijacker 
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to exist in a particular model of vehicle or be ascertained by inspection, such potential hijacker 
may learn to effect driver transfer without disturbing the switch and/or put the authorised driver 
at risk of greater harm by abducting him and forcing him to drive to a place where such transfer 
can be affected or the authorised driver forced to part with, the details for cancelling 
immobilisation. 

As indicated above, such hijacking or vehicle snatching is one example of separating an 
authorised user of functioning apparatus from the apparatus and in order to benefit from its 
functioning it is an object of the present Invention to provide an authorisation system for [and 
method of] preventing function of apparatus removed from the presence of an authorised user 
that is versatile and readily implemented and less compromising to the user's safety than 
systems [and methods] known hitherto. 

According to [a first aspect of! the present Invention an authorisation system, for permitting 
apparatus functional under the control of an operator to function normally only in the presence 
(as herein defined) of ari authorised user, comprises complementary parts of wireless 
communication means arranged to be carried In operation by the apparatus and a [said] 
authorised user of the apparatus and opersible to effect, within a spatial envelope defining a 
predetermined pemiissible working relationship between tiie authorised user and tiie 
apparatus, a communication link defined by continual transfer [with reference to a temporal 
envelope] of Identifying information pairing the authorised user and the apparatus, said 
communication means being responsive to existence of said link to effect authorisation of the 
apparatus permitting it to function normally under said operator control and to cessation of an 
existing link to functioning apparatus to Inhibit normal functioning of the apparatus after a 
[predetennlned] time delay [of such duration as to ....?]. 
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Preferably the communication means is operable in the radio frequency band. Preferably the 
communication means comprises user transmission means carried by the user part and 
apparatus reception means carried by the apparatus part, having therein means to produce 
an identity reference unique to the pair, the UTM being operable to transmit radiation 
modulated in accordance with said identity reference and the ABM being responsive to receipt 
of said modulated radiation to confirm by transfer of identifying information including said 
identity reference existence of a communication link between them. 

The communication means may further comprise apparatus transmission means in the 
apparatus part and user reception means In the user part an-anged to effect bi-directional 
communications between the apparatus part and the user part. Then, the user and.apparatus 
parts may each have therein means to produce a further identity reference unique to the pair . 
the ATM being operable to transmit radiation modulated in accordance with said further Identity 
reference and the URM being responsive to receipt of said modulated radiation to confirm 
existence of a communication link between them. 

In any event the URM may be responsive to receipt of a transmission from the ATM to enable 
transmission from the ATM. Furthermore, at least the. UTM of the user part may derive 
operating power from the radiation received from the ATM. 

The identity reference, and if appropriate the further identity reference, may be based upon 
generation of at least one random or pseudo-random number. 

Preferably said modulation of the transmitted radiation is in accordance with a digital code. 
Where this Is so, said modulation may be In accordance with a rolling digital code changed for 
each transmission. 
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Alternatively or additionally, the communication means may be arranged to change at least the 
carrier frequency of the modulated radiation In accordance with a digital code during 
communication. Where this is radio frequency, the communication means is arranged to effect 
a communication link in accordance with the Bluetooth wireless specification or comparable 
wireless peer-to-peer networking specification. 

The temporal envelope may comprise at each of sequential time intervals a time window of 
predetermined duration, and the apparatus part responsive to receipt of identifying information 
from the user part within each time window to provide authorisation of the apparatus until the 
next window and responsive to absence of identifying information to determine cessation of 
the communication link. 

The apparatus part may be responsive to the absence of receipt of identifying information 
within a predetermined number of consecutive time windows to determine cessation of the 
communication link. The sequential time intervals are contiguous or spaced apart. Irrespective 
of the relationship between time intervals, the time window associated with each time interval 
may have a duration extending between successive time Intervals. 

An authorisation system according to the present invention as defined in the preceding 
paragraphs may advantageously be adapted for use with moveable apparatus susceptible to 
being taken from the possession of the authorised user whilst functioning, and wherein the 
time delay is chosen having regard to the movability of the apparatus to permit a taker of the 
apparatus fo become separated from the authorised user by a distance sufficient to ensure the 
safety of the authorised user. Preferably, the time delay is greater than 30 seconds and may 
be in the range 30 seconds to Sminutes. * 
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An authorisation system according to the present invention is particularly suited to permitting 
use of apparatus comprising a vehicle having an occupants cab and an engine and whereby 
normal function thereof is by an" operator who is an occupant and driver; the authorisation 
system then has the spatial envelope defined to encompass, and preferably be substantially 
co-extensive with, the occupants cab and the apparatus part is arranged to form a 
communication link with a user part carried by an occupant of the cab and to be bperably 
coupled to the vehicle to authorise or Inhibit functioning of the vehicle engine by the driver, that 
is, bring the vehicle to rest and inhibit it from further movement. 

Insofar as such a vehicle has its engine supplied with fuel by way of a fuel delivery system, the 
apparatus part of the system may be arranged to be operably coupled to the vehicle to 
authorise or inhibit delivery of fuel to the engine. Additionally or alternatively, it may be 
operable to effect said inhibition of normal functioning after a said time delay by progressively 
reducing the delivery of fuel to the engine during said time delay. 

Insofar as an authorisation system according to the invention is not limited to specific 
apparatus, and sudden failure of the apparatus may arouse suspicion, the apparatus part may 
be operable in the time delay to effect temporary or permanent inhibition of multiple functional 
aspects of the apparatus to disguise responsibility of any particular functional aspect for non- 
functioning of the apparatus. 

Furthermore, if the authorisation system is employed for apparatus having a telephone 
communication ability, the apparatus part may be operable during said time delay to effect a 
telephone call to a. predetermined recipient. 



P650391GB -8- 3 May 2002 (4:00PM) 

When the authorisation system is adapted for use with apparatus such as the aforementioned 
vehicle in which operation of the apparatus is Initiated by the operator prior to effecting control 
of functioning thereof, the apparatus part may be responsive to initiation of operation of the 
apparatus by the. operator to Initiate establishment of the communication link prior to, or 
contemporaneously with, functioning of the apparatus. 

The apparatus part of the authorisation system may be arranged to be canrled by the 
apparatus In functioning but removable when It Is not intended to function and in such 
circumstances may Include apparatus operation Initiation means operable to permit Initial 
operation of the apparatus. 

An authorisation system according to the Invention may have the communication means 
include a relay part arranged to be disposed, in respect of the communication link, between 
the user part and apparatus part and wherein at least the user part Is arranged to transfer 
Identifying information by way of [establish a communication link with] the relay part In 
preference to establishing a communication link with the apparatus part directly. The 
communication means may be arranged to attempt to establish a communication link including 
the relay part and In absence thereof to establish a communication like directly between the 
user part arid the apparatus part. 

The relay part is arranged to be carried by the user in operation, and It may include, or be 
Included In, additional functional apparatus under the control of the authorised user and the 
relay part is arranged to effect in response to cessation of an existing communication link with 
the user part of the communication means during functioning of the additional apparatus 
Inhibition of normal functioning after a time delay. 
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Embodiments of the invention will now be described with reference to the accompanying 
drawings, in which: 

Figure 1 (a) is 

Figure 2 is 

Figures 3(a) and 3(b) 
Figure 4 
Figure 5 

Referring to Figure 1 (a) a vehicle 10 comprises apparatus which functions normally, that is. 
m respect of performing those functions nomially required of it. under the control of an operator 
1 2 who is more conventionally called the driver. The vehicle is moveable and includes a cab 
1 4 which typically has seats for a plurality of occupants 1 2, including the driver. Whereas for 
normal functions the vehicle is under the direct control of the driver, the functioning of the 
vehicle may be authorised by any user of the vehicle occupying of the cab. that is. the driver 
or another occupant sub-authorising the driver. 

The vehicle is not described in any more detail than is necessary to explain the invention and 
typically includes an engine shown at 1 6 which is controlled by the driver in respect of initiating 
its ot)eration and changing performance functions, optionally in conjunction with an electronic 
engine management unit (EMU) 20. 

The engine 1 6 is powered by liquid fuel delivered to the engine from a storage tank 22 by way 
of a fuel delivery system including electrically operated supply pump 23 and fuel distribution 
and input means 24. which may comprise a carburettor (as shown, ghosted at 24,), that 
includes a small storage chamber for fuel, or, more conventionally in modem gasoline engines. 
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and in compression ignition (diesel) engines a plurality of fuel injection pumps and valves 242- 
Other features of the vehicle/as they relate to Its operation are shown by the enlargement of 
the circled region, in Figure Kb). 

To complete the overview of the vehicle as apparatus under the direct control of an operator- 
driver, such operator eiffects operation by initiating functioning of both the vehicle chassis and 
of the engine by which the vehicle moves. Initiation of operation usually Is effected by the 
driver, as authorised operator, inserting a key device 26^ into a co-operable lock 262 which 
releases a steering lock (not shown) and authorises the EMU 20 to enable the engine to be 
started and the supply pump 23 to deliver fuel for the engine. The key device 26^ may take 
the form of a physical key 27^ and optionally carry in the key radio frequency transducing 
means 272, paired with a lock 28^ (and optional transceiver 282) fitted to the vehicle. In the 
manner disclosed inter alia in GB-A-2342742 the transceiving means is arranged to program 
the key in use, issuing it with a code to be transmitted upon next usage so that only if the 
codes agree does the key function to initiate operation of the engine, and for practical 
purposes making it virtually impossible to start the engine without permission of the genuine 
or authorised key. 

An alternative key device, as shown ghosted at 29^, employs a key-card of flexible plastics 
material and carrying thereon .means in the form of a magnetic strip or a semi-conductor 
integrated circuit including a processor and memory and often known to as a smart-card, which 
is able to co-operate with a reader 282 fitted to the vehicle. Such a card-key is able to store 
a larger number of parameters vital to initiating operation of the engine, and may also be re- 
programmed from usage-to-usage, but nevertheless serves as a key device to effect initiation 
of vehicle engine operation by virtue of being In the possession of the user at start-up and in 
position in the vehicle thereafter. 
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As outlined above, such in-situ programming of the primary engine initiating device (key, key- 
card) is intended to make it difficult for an unauthorised user to tamper with the vehicle, 
particularly the EMU in order to start the engine and steal the vehicle, or as additional anti-theft • 
devices which respond to an attempt at unauthorised entry into the vehicle cab or engine bay 
or even disturbance of the vehicle itself to trigger an alarm. 

[XXXoutXXFurthermore as also described in the aforementioned GB-A72342742 it is also 
known to prevent attempts by-passing the security function of the EMU in such a way that the 
fuel supply pump can be operated 4n conjunction with limited ignition function to run the engine 
for the purpose of unauthorised taking of the vehicle.] 

Known arrangements for ensuring that the vehicle, through its engine, functions normally only 
for the driver in possession of the appropriate key device, and as discussed above the effect 
is to treat the possessor of the key device as the authorised user and it leads to the situation 
where a criminal is tempted to steal the appropriate key device for the vehicle and further 
tempted to ensure the key device is correctly authorised by separating the key device from the 
owner at a time when the owner is In the vicinity of the vehicle, or has it fully functioning in the 
process of being driven; that is, hijacking. 

In accordance with the present invention there is Introduced an authorisation system, indicated 
generally at 30, with the intention of permitting functioning of the vehicle normally under driver 
control only In the actual presence of an authorised user, rather than merely the presence of 
the normal key devices which hitherto has constituted de-facto authorisation. In this 
embodiment an authorised user may be any occupant 1 2, of the vehicle cab, conveniently, but 
not necessarily, the driver 1 2, and presence is that defined by presence within [or immediately 
adjacent] the vehicle cab. 
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In general terms, the authorisation system comprises wireless communication means 32 
having complementary parts 34 and 36 arranged to be carried in operation by the apparatus 
(the vehicle), and a said authorised user of the apparatus (here shown as driver 12) 
respectively. The parts may communicate by any suitable contactless system, such as 
optically or ultrasonically, but preferably operate at radio frequencies and preferably at those 
In the GHz Or microwave bands. 

The. parts of the communication means, conveniently referred to as the "apparatus" or 
"apparatus-carried" part 34, and "user" or "user-carried" part 36, are arranged to effect, within 
the spatial envelope of the cab that defines a permissible working relationship between the 
authorised user and apparatus (vehicle), a communication link defined by continual transfer 
of identifying Information pairing the authorised user and the apparatus. The identifying 
information is described further below as is the nature of continual transfer, being with respect 
to a temporal envelope which supplements the spatial envelope defining permissible 
separation of the parts. 

The communication means 32 Is responsive to the existence of said link that confirms the 
"presence" of the authorised user to effect authorisation of the vehicle, permitting It to function 
normally under control of a driver-operator In possession of the appropriate key device, but to 
deny authorisation when not present, preventing a driver who is not the authorised user from 
using the key device obtaining or maintaining functioning of the engine of the vehicle. 

Initiation of operation of the vehicle may be effected separately from, or contingent upon, such 
communication link, but most importantly, the communication means is responsive to cessation 
of an existing communication link with previously authorised and functioning apparatus to 
inhibit the.normal functioning of the apparatus after a time delay. of such duration, in excess 
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of 0.5 minutes and may be up to 5 minutes, as to characterise the authorised user and vehicie 
as having moved apart. 

This embodiment is particulariy concerned with, and adapted for. an above-discussed hijacl< 
situation wherein the fully functioning vehicle, containing the authorised user and driver, is 
halted and the occupant or occupants forced to leave, and possibly compounded by the 
hijacker then removing from the erstwhile occupants any cellular telephone or comparable 
communication devices by which the authorities may be alerted before driving away in the 
othenwise functioning vehicle. 

To this- end, the user part 36 of the communication means 32 Is arranged to be worn 
inconspicuously or secreted about the person of the authorised user, and notwithstanding the 
requirement for such part to effect a radio communication link with the apparatus part, this is 
feasible having regard to the relatively small spatial envelope in which a communication link 
has to be established with the apparatus part. 

The apparatus part 34 may be permanently fixed with respect to the vehicle to control its 
engine operation or fixed with respect to, or form part of, an operating key device, such as key 
27i or key card 29i, which is, in operation, carried by the vehicle and without which device it 
will not function. 

In normal use of the vehicle, that Is, absent any hijacking situation, the authorised user, carryig 
the user part of the communication means, upon entering the spatial envelope defined 
substantially by the vehicie cab creates the circumstances whereby the communication means 
may form a communication link between the user-part and apparatus part, which link is 
considered maintained by the continual transfer of identifying information pairing the authorised 
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user and vehicle to the apparatus part. The communication means may exist because of 
permanent or prior empowerment of the relevant part or parts, or may result from 
empowerment arising from the driver using the appropriate key device to initiate functioning 
• of the engine. Notwithstanding various options discussed below, by combination of a function- 
authorising wireless communication link and key device - enabled operation of the vehicle 
engine, the vehicle is set to function normally without any additional overt actions necessary 
on the part of the authorised user, other than his presence. 

Thus, in such a hijack situation, and depending upon how precisely the spatial envelope of the 
communication link between the user part and the apparatus part is defined, upon the 
authorised user leaving the vehicle cab and the vicinity of the vehicle (distancing himself 
therefrom or having the vehicle drive away) there is a cessation, of the authorisation 
communication link to the functioning vehicle. 

The apparatus part 34 of the communication means Is functionally connected to the vehicle, 
to cause the vehicle to stop functioning after a time delay of such duration as to permit the 
hijacker to become separated from the authorised user. The time delay not only permits the 
hijacker to move the vehicle from the hijack scene for a distance that is intended to be too 
great to justify returning to confront the authorised user but also an opportunity for the 
authorised user to leave the hijack scene. The vehicle is stopped from functioning at the 
appropriate time either by preventing delivery of fuel to the engine by the fuel pump, stopping 
the engine suddenly, or by modifying operation of the pump, EMU or other electrical functions 
to degrade functionality more gradually over at least part of the time delay period. The engine 
may also be caused to stop functioning by effecting temporary, intermittent inhibition of 
multiple functional aspects of the vehicle to disguise from the hijacker responsibility of any 
particular functional aspect for non-functioning of the vehicle. 
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On the assumption that the authorised user will be re-united with a non-functioning vehicle 
abandoned by a hijacker, the communication means may be arranged to respond to a 
resumed presence of the user part to re-establish the communication link that returns full 
furictionality to the vehicle, but preferably the apparatus part is arranged to lock the inhibition 
of vehicle functionality at least until some positive action is taken to remove the inhibition. A 
vehicle would have its functionality locked out on a temporary basis, to be overcome by locally 
or remotely controlled re-setting switch means, but other apparatus, depending largely upon 
the structural form of the apparatus part, may have its functionality locked on a temporary or 
permanent basis. 

For Instance, if the apparatus part is of the removable key-card type, locking out of vehicle 
functionality may comprise permanently destroying information or functioning of the card. A 
programmable key device that locks-out upon cessation of the communication link may be re- 
programmed to overcome temporary loss of functionality. 

The apparatus part of the communication means may also include authorised disablement 
means to override the authorisation system when the vehicle is in the care of trusted non- 
authorised users, conveniently associated with such re-setting means or as a replacement 
"master key" device. 

• It will be appreciated from above that there are a number of ways in which the communication 
link may be established and its cessation determined. 

Referring now to Figure 2 which shows in schematic, blocl< diagram form a first embodiment 
of communication means at 32i the comprises apparatus and user parts 34^ and 36^ 
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respectively and control means 38^ coupled to the engine functioning components 20 and/or 
23) 

The user part 36^ includes user transmission means 40^ which is operable to emit radio 
frequency radiation at low power in any suitable band, a power supply unit (PSU) 44^ 
comprising a self-contained primary or secondary battery and, if necessary, a manually 
operated power switch 45/ to prevent drainage of the battery when the transmission means 
is not in use, and user processing means 461 including timing and storage means 471 to 
produce an identity reference unique to the user part and apparatus part pair for transmission 
and effect transmission of radiation modulated in accordance with the identity reference. The 
term "modulation" as used herein is intended to include any common form of effecting variation 
of a radio frequency emission and is intent to include modulation in amplitude or frequency or 
emission per se in accordance with a digital code. 

In the presently described embodiment the user processing means 461 is arranged to effect 
transmissions at intervals, each transmission having a duration short relative to the interval. 

The apparatus part 34^ comprises ARM 501 which is operable to receive also demodulate or 
decode the emissions from the UTM, power supply unit 541 , which is a secondary battery 
arranged to be charged by connection to the vehicle supply but operable independently 
thereof, and apparatus processing means 541 (having timing and storage means 571) 
arranged to synchronise the ARM with respect to receiving the transmissions from the- UTM 
and for recognising the identity reference from the appropriate modulation form. 

In the presently described embodiment the modulating form Is a digital code produced by the 
user processing means and retrieved by the apparatus processing means. The apparatus 
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processing means stores a corresponding code or the means for generating sucli code 
whereby a comparison is able to confirm or otherwise the transfer of identifying information 
including said identity reference, and by such transfer the existence of a communication link 
between them. 

Existence of such communication linl< is notified to the control means 38i which in turn 
authorises functioning of the vehicle by removing a default Inhibition of the EMU and/or fuel 
supply pump 23 that prevents vehicle function by way of the normal driver key device. 

The transmitting power or directionality of the UTM and/or the receiving sensitivity or 
directionally of the ARM combine to define the spatial envelope upon which a successful 
communication link Is based. 

As discussed above, it is continuity of an established communication link that is of importance 
to authorise functioning of the vehicle and cessation of the established link to remove 
authorisation in a time delayed manner, and to this end the continued existence of the link is 
defined not only by the dispositions of the user UTM and ARM relative to the spatial envelope 
but also by transmission and reception with respect to a temporal envelope whereby 
transmissions are considered to be continually, made and received so as to satisfy the criterion 
of existence of a communication link that sustains authorisation, even if intermittent and 
discontinuous. 

Making reference to Figure 3(a), such temporal envelope comprises in each of a plurality of 
sequential time intervals Tl^, TI2 r- TIN, a time window TW^, TWg .... TWN, ... of 
predetermined duration. Both user processing rneans 461 and apparatus processing means 
561 define the time intervals and the user processing means effects transmission for or within 
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a time window in eacli internal. The apparatus processing means then determines if in each 
time interval a suitably modulated transmission is received. If desired, the apparatus 
processing m^ans may be further restricted to acl<nowledge receipt of a transmission only if 
It occurs within a time window pre-defined as. occurring within a part of the window. 

Although it Is possible hypothetically to pre-define matching time intervals and windows within 
the user and apparatus processing means, in practice It is difficult to keep them synchronised, 
if they operate completely independently, and each received (and confirmed) transmission may 
be used to synchronise the apparatus processing means with respect to the user processing 
means and/or the transmitted Identity reference may contain data defining the relative time to. 
and duration of, the next transmission. 

The time intervals may be contiguous as shown in Figure 3(b) and, If desired, the time 
windows in each may extend from the full interval, as shown for time window TWN,creating 
a continuous transmission-reception situation, although such a scheme may be perceived to 
be wasteful of user part power reserves. 

It will be appreciated that the above described communication means 321 . with its apparatus 
and user parts 34, and 36, has simplicity in having a single transmitter and receiver, but also 
some limitation, such as the need to determine In advance what the UTM is to transmit and 
when and for the ARM to be set in advance, or adapt to received transmissions, to pair 
therewith. Also, insofar as it is intended for the user part 36, to be carried unobtrusively by the 
authorised user, the self-contained power supply 441 Is necessarily of limited capacity and 
notwithstanding only intemiitted transmissions may require the userto effectmanual switching 
of the part for use. 
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Such restrictions may be overcome wholly or in part by effecting the communication link by 
way of bi-directional communication between the apparatus part and the user part. 



It will be seen that the parts 342 and 362 are in many respects the same as the parts 341 and 
361 and the commonly used elements will be referred to with corresponding reference 
numbers (other than the suffixes) and not described again unless differing in some respect. 
Referring now to Figure 4, this shows for a second embodiment of authorisation system 
communication means 322 comprising apparatus part 342 and user part 362. The apparatus 
part 36i includes in association with the apparatus processing means 562 apparatus 
transmission means 602 and the user part 34^ includes in association with the user processing 
means 462 user reception means 702. 

The communications between the parts from the apparatus part to the user part may permit 
several enhancements in terms of the identification information pairing them, the temporal 
envelope and, importantly, notwrthstanding the additional components, minimising the power 
usage and requirements of the user part. 

Transmissions from the apparatus part to the user part may contain the aforementioned 
identity reference, so that the user processing means only responds thereto, but preferably 
contains a further identity reference which is decoded by the user processing means 462 such 
that the UTM in turn transmits its next signal modulated in accordance with them both, thus 
both the user processing means and the apparatus processing means have access to two 
identity references.- In this way the identity references may be made to change consistently, 
as a rolling code, and notwithstanding the need for frequent transmissions to sustain the 
communication link. 
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The transmission of signals from the apparatus part to the user part also permits the latter to 
be arranged only to transmit when in receipt of a suitable signal from the ATM. Thus the 
apparatus processing means may define the aforementioned time intervals and time windows 
in accordance with some pre-programmed and/or randomised regime whereby the 
transmission of signals from the UTM Is always synchronised to a reception window. 

Furthermore, the radio frequency energy of apparatus part transmissions may be employed 
by the user part 362 to provide or supplement the operating power of its supply 442; that is, 
the URM may include rectification means 722 for a part of the signal and charge a secondary 
battery source or, in some instances, a capacitor (not shown) that replaces such primary or 
secondary battery source. Depending upon the storage capacity of the power supply 442. the 
receipt or lack of receipt of signals from the ATM may comprise direct control over the user 
parts ability to effect a response transmission. Alternatively, the user processing means 462 
may put the user part into a low consumption "sleep" mode until awoken l?y receipt of a 
suitably verified transmission from the apparatus part 

Conveniently, the Identity reference modulation applied to transmissions from each of the ATM 
and UTM comprises a digital code which Is based upon one or more random or pseudo- 
random numbers generated within either or both of the apparatus part or user part and/or 
encrypted and decrypted In accordance with algorithms stored In said parts; for example. In 
a manner similar to that described in the aforementioned GB-A-2342742 but here applied to 
the radio frequency transmissions between the parts and repeated continually as defined by 
the temporal envelope. Thus within each time window, the apparatus part expects to receive 
a signal which contains an identifying reference unique to the pair, and preferably one unique 
to the transmission, Insofar as It is based upon a number randomly or pseudo-randomly 
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generated by the apparatus part transmitted to and modified by tlie user processing means 
for its identity reference from which the original number that can be extracted for confirmation. 

instead of. or in addition to, elaborate and encrypted codes to effect the pair identifying 
information, the transmission and reception parts may also be arranged during each 
transmission to undergo carrier frequency hopping to further lessen the chance of incorrect 
pairing or loss of communication link in accordance with the Bluetooth standard or a 
comparable radio frequency peer-to-peer networking standard- [ descr] 

As discussed, the apparatus part expects receipt of an appropriate piece of identifying 
information within each time window and such receipt within each time window toprovide 
authorisation of the apparatus of the apparatus until the next window. If that infomiation Is not 
forthcoming, manifested by incorrect modulation information or insufficient received signal 
strength, because the paired user part not within range as defined by the spatial envelope, the 
apparatus part, through the control means 381 initiates a check for the absence of receipt of 
identifying information in a predetermined number of consecutive time windows to determine 
if it was a temporary loss or permanent. If such check confirms absence for said 
predetermined number of consecutive time windows, a cessation of communication link is 
declared to exist and delayed loss of vehicle function initiated. 

The above embodiment has been described with respect to both uni-directional and the 
preferred by-directional operation, but in both cases, the user part is of significant complexity 
insofar as it contains processing means and transmission means including control arid 
modulation circuitry therefor. . 
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Referring now to Figure 5 a tliird embodiment of communication means 323 is sfiown which 
effects a communication link between apparatus part 343 and user part 363 based upon bi- 
directional communication, the user part is in principle the same as 342 but, in keeping with 
the arm of achieving or an unobtrusive, readily carried form, empowered by radio frequency 
energy transmitted by the ATM, or indeed any other suitable electromagnetic energy, and 
comprises an analog or digital identity reference tag' recognised by a reader in the form of the 
ATM/ARM Which transmits to it continually (as herein defined) and responds as appropriate 
to receipt or lack of receipt of a response. 

Such a tag may take a simple analog form, as an inductive-capacitive (L-C) circuit tuned to a 
particular frequency of ATM transmission and which effects reflection or frequency doubling 
of the ATM transmission, or in a digital form in which a stored code is transmitted upon 
empowerment by reception of radio frequency energy from ATM. [Such digital tags are 
available from .****** see P650375] 

It will be appreciated that for any apparatus part, it may be arranged to be paired with a 
plurality of different user parts aiid likewise for any user part to be paired with a plurality of 
different apparatus parts, and although it would be expected for the apparatus part to pair with 
a single user part to define a communication link by cycling through possible user parts to pair 
with upon Initiation, the setting up of a communication link based upon intermittent 
transmission-reception windows makes it possible to accommodate several authorised user 
parts for one apparatus part simultaneously. 

Each of the above described embodiments comprises establishmerit of a communication link 
between a user part arid apparatus parts of a pair directly. 
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As discussed above, it is preferred ttiat the user part has minimum dimensions and tiius lias 
minimal on-board power storage capacity and iow transmission power, iiisofar as the 
apparatus part is in general associated with a vehicle .(or other apparatus) which is large 
enough to permit the apparatus part to accommodate within it, or be connected to, a power 
source of significant storage capacity. It is preferred to design the apparatus part for maximum 
sensitivity to reception of signals from low power user part transmissions and to maximise the 
ATM power (if appropriate) to lessen any power burden on the user part. 

To further facilitate achievement of such desiderata for the. user part, referring now to Figure 
6, thus shows In block a schematic form at 304 a fourth embodiment of authorisation system 
in accordance with the invention wherein the communication means 324 comprises, in addition 
to the user and apparatus parte 364 and 344, corresponding to parte 362and 342 described 
above, a relay part 804 arranged to be disposed, in respect of the communication link, 
between the parts wherein at least the user part 364, and preferably also the apparatus part 
344, is arranged to transfer identifying Information by way of the relay part in preference to 
establishing a communication link directly. 

As illustrated In the Figure, the relay part is arranged to be carried by the authorised user 12 
in operation and may be less unobtrusive than the user part 364 and including a more powerful 
a battery power supply and transmission means and, if appropriate, receiver means, for 
communicating over a distance with respect to the apparatus part that Is long relative to the 
distance to the user part, thereby permitting the user part to be made even smaller and carried 
more unobtrusively. 

The relay part is under the physical conti-ol of the authorised user and may advantageously 
comprise additional functioning apparatus, such as a cellular phone device, which includes 
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many of the components required of the relay part, and from which the user also runs the risk 
of being separated, not only when forcibly separated form the vehicle by a hijacker but also 
when the apparatus is carried by the user remotely from the vehicle. 

The communication link is thus effected by transmission from the user part to the relay part 
and from the relay part to the apparatus part, so that if, having established such link by virtue 
of the relay-carrying authorised user correctly initiating functioning of the apparatus, any 
cessation of the link caused by either or both of the user and relay parts being separated from 
the apparatus part or each other causes delayed inhibition of vehicle functioning. 

Although fundamentally it is only necessary for the relay part to be present in respect of 
transmissions from the user part to apparatus part, insofar as any link Is bi-directional and 
carries identifying information unique to the transmission, it is prefen-ed that the relay part 
encompasses full bl-dlrectional communications with at least the user part, and many cellular 
phones are already enabled to communicate with local devices using the above-mentioned 
Bluetooth technology. 

It will be appreciated that a functlonirig cellular phone or the like which is normally carried on 
the person of the authorised user when away from the vehicle, may be disposed in the vicinity 
of. rather than on the person of. the authorised user when the latter Is within the vehicle burt 
may nevertheless be employed as such relay part without affecting functionality of both cellular 
phone and vehicle. 



It will be furthermore appreciated that additional functioning apparatus suitable for use as the 
relay part may comprise a so-called hand-held or lap-top computer, watch or entertainment 
device, any of which may be carried by. and at risk of being taken from, an authorised user. 
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Any such device is particularly suitable if, as mentioned above, it is enabled for wireless per-to- 
peer networking using the Bluetooth or like system. Such relay part may, of course, have no 
other function than to operate as a relay part. 

It will also be appreciated that notwithstanding the above description of functional apparatus 
as being a vehicle and "additional" functioning apparatus as a relay part in forming a 
communication link therewith, such functioning and communicating apparatus as normally 
carried by the authorised user may constitute the functioning apparatus which is the 
authorisation system is for. Etc... 



Additional (Specification) Information 



A counter key device ( Fig. 8) may also be included to enhance the present inventions security aspects. 
The counter key device may also have a continuous communication link and communicate with the key 
device and control device. This communication link preferably operates on radio firequency signal or 
infiu red fi-equency /peer-to-peer / Bluetooth. 

The advantages of having a counter key device are to be found in the area of security or personal safety 
of the authorised user. For example the counter key device may restrict the use of apparatus i.e, govern 
speed of vehicle or limited use of apparatus. The counter key device may also be used for multi 
functional operational purposes of the apparatus. Other advantages include methods such as additional 
system power or memory capabilities etc. 

The counter key device may also be programmed to signal a lisers "unique users identification code 
number" for the purposes of accessing apparatus and operating systems such as the internet, 
telecommunications systems and various oth&r apparatus s operation^ systems and networks etc. The 
unique code incorporated in the counter key device may be relayed to a receiver device incorporated in 
to various apparatus software systems and networks etc. 
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